Railway says an unauthorized party may have read customers' environment variables

Railway published a security disclosure on October 21, 2026. It says Railway detected anomalous activity that morning involving systems that store customer environment variables, and that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Railway notes that environment variables may contain API keys and database and registry credentials. It says it believes this is part of a series of attacks targeting platform companies with the aim of compromising AI inference providers, and that it notified those upstream providers to revoke keys.

The disclosure said Railway's initial analysis suggested the impact may be limited to a subset of users, and that Railway would email affected customers directly as it confirmed them. It recommended that all users immediately roll every environment variable stored in Railway, including API keys and private registry credentials, and review the logs of those services for unusual activity.

Railway's preliminary report, dated October 22, says Railway believes the attack took place "from October 20th 13:58 UTC to October 22nd 03:32 UTC". That is 6:58 AM PT on October 20 to 8:32 PM PT on October 21. The second time is when Railway confirmed the attacker no longer had access to any internal systems. The report says the attack was "attempting to obtain AI provider API keys to perform distillation attacks". It says "at most 1.85% of all workspaces had some environment variables potentially compromised", or about 100,000 workspaces. Its timeline describes an unauthorized query of encrypted environment variables, "of which a subset were decrypted", and Railway says it was unable to know which variables specifically were decrypted.

On October 21, Railway notified vendors, and "Vendors were requested to revoke all keys for their service". The report says Railway worked with GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe, and others to revoke the potentially compromised keys, and that a revocation notice from a vendor does not by itself mean your key was impacted. Railway says it has notified the customers that were directly impacted, and is also reaching out to customers it considers high risk, a group larger than the 1.85%. The report says: "The attacker did not access Railway user accounts as part of this incident." On source code, Railway says it is "not ruling out that they accessed user source code" and will confirm in its final forensic investigation report. It recommends that "all customers who signed up prior to October 21 rotate their keys stored on Railway". It also advises all customers to remove public network access to databases, check GitHub account audit logs and review all app access, and check audit logs in registries such as Docker Hub.

Railway's status page linked the disclosure at 21:59 UTC on October 21 (2:59 PM Pacific). Other updates say Railway was rotating all storage bucket credentials, invalidated all Railway API tokens, and signed some users out by invalidating OAuth sessions. Deployments were paused on every plan. Builds came back on every plan on October 22. On October 23, Railway's status page said it had finished notifying users whose workspaces met its criteria for increased risk as of 11:57 AM PT, and that "Workspaces outside those higher-risk groups are not confirmed safe from compromise." At 3:06 PM PT it marked the incident resolved, saying builds, deployments, the Railway API, and the dashboard were operating normally, while new signups remained temporarily paused. Railway also published step-by-step guides on its blog for rotating PostgreSQL, MySQL, Redis, and MongoDB credentials, reconnecting GitHub, and checking Stripe, OpenAI, Anthropic, AWS, and GCP for unexpected use. Railway's Stripe guide says to rotate potentially exposed keys before investigating misuse.

Railway breach: rotate secrets walks through the rotation in order, from Railway variables to database passwords and third-party keys. ShipSecurely has removed the Railway referral links it had on some guide pages.